@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.19

package/dist/StorageSchemaGenerator.js

@@ -0,0 +1,1418 @@
+import { postgresAuthStorageMigrations } from "./PostgresStorageMigrations.js";
+import { sqliteAuthStorageSchema } from "./SqliteStorageSchemaData.js";
+export const storageSchemaGeneratorApiVersion = "effect-auth.storage-schema-generator/v1";
+export const storageSchemaGeneratorVersion = "1.5.0";
+export const storageSchemaVersion = "0010_auth_oauth_device_authorization";
+export const storageSchemaVersions = {
+    postgres: storageSchemaVersion,
+    sqlite: "0029_auth_oauth_device_authorization",
+};
+export const supportedStorageDatabases = ["postgres", "sqlite"];
+export const supportedStorageAdapters = ["effect-qb", "drizzle"];
+export const supportedStorageGeneratorModes = ["fresh"];
+export const supportedDevelopmentSeedTargets = [
+    "alchemy-d1",
+    "bun-sqlite",
+    "node-sqlite",
+    "postgres",
+];
+export const supportedDevelopmentSeedComplexities = ["medium", "low"];
+export const storageDatabaseAdapters = {
+    postgres: supportedStorageAdapters,
+    sqlite: supportedStorageAdapters,
+};
+export const developmentSeedTargetsByDatabase = {
+    postgres: ["postgres"],
+    sqlite: ["alchemy-d1", "bun-sqlite", "node-sqlite"],
+};
+export const developmentSeedTargetsByDatabaseAdapter = {
+    postgres: {
+        "effect-qb": ["postgres"],
+        drizzle: ["postgres"],
+    },
+    sqlite: {
+        "effect-qb": ["alchemy-d1"],
+        drizzle: ["alchemy-d1", "bun-sqlite", "node-sqlite"],
+    },
+};
+export const storageModuleCatalog = [
+    {
+        id: "core",
+        description: "Users and login identities.",
+        dependencies: [],
+        tables: ["auth_user", "auth_user_identity"],
+    },
+    {
+        id: "credentials",
+        description: "Password and other typed credentials.",
+        dependencies: ["core"],
+        tables: ["auth_credential"],
+    },
+    {
+        id: "sessions",
+        description: "Authenticated sessions.",
+        dependencies: ["core"],
+        tables: ["auth_session"],
+    },
+    {
+        id: "verification",
+        description: "Short-lived verification challenges.",
+        dependencies: ["core"],
+        tables: ["auth_verification"],
+    },
+    {
+        id: "totp",
+        description: "TOTP factors.",
+        dependencies: ["core"],
+        tables: ["auth_totp_factor"],
+    },
+    {
+        id: "recovery-codes",
+        description: "MFA recovery codes.",
+        dependencies: ["core"],
+        tables: ["auth_recovery_code"],
+    },
+    {
+        id: "refresh-tokens",
+        description: "Rotating refresh-token families.",
+        dependencies: ["core"],
+        tables: ["auth_refresh_token"],
+    },
+    {
+        id: "oauth-accounts",
+        description: "External OAuth account links.",
+        dependencies: ["core"],
+        tables: ["auth_oauth_account"],
+    },
+    {
+        id: "passkeys",
+        description: "WebAuthn passkey credentials.",
+        dependencies: ["core"],
+        tables: ["auth_passkey_credential"],
+    },
+    {
+        id: "api-keys",
+        description: "User API keys.",
+        dependencies: ["core"],
+        tables: ["auth_api_key"],
+    },
+    {
+        id: "jwt",
+        description: "JWT revocations.",
+        dependencies: [],
+        tables: ["auth_jwt_revocation"],
+    },
+    {
+        id: "audit-log",
+        description: "Append-only authentication audit events.",
+        dependencies: ["core"],
+        tables: ["auth_audit_log"],
+    },
+    {
+        id: "login-approval",
+        description: "Out-of-band login approval reviews.",
+        dependencies: ["core", "verification"],
+        tables: ["auth_login_approval_review"],
+    },
+    {
+        id: "login-risk",
+        description: "Login risk history.",
+        dependencies: ["core"],
+        tables: ["auth_login_risk_history"],
+    },
+    {
+        id: "trusted-devices",
+        description: "Trusted-device tokens.",
+        dependencies: ["core"],
+        tables: ["auth_trusted_device"],
+    },
+    {
+        id: "webhooks",
+        description: "Webhook delivery and replay state.",
+        dependencies: [],
+        tables: ["auth_webhook_outbox", "auth_webhook_replay"],
+    },
+    {
+        id: "domain-verification",
+        description: "Domain ownership proofs.",
+        dependencies: [],
+        tables: ["auth_domain_verification"],
+    },
+    {
+        id: "security-timeline",
+        description: "User security timeline entries.",
+        dependencies: ["core"],
+        tables: ["auth_security_timeline"],
+    },
+    {
+        id: "oauth-provider",
+        description: "OAuth authorization-server clients, grants, and tokens.",
+        dependencies: ["core", "verification"],
+        tables: [
+            "auth_oauth_client",
+            "auth_oauth_consent",
+            "auth_oauth_authorization_code",
+            "auth_oauth_device_authorization",
+            "auth_oauth_client_secret",
+            "auth_oauth_provider_mode_token",
+        ],
+    },
+    {
+        id: "oauth-token-vault",
+        description: "Encrypted upstream OAuth provider tokens.",
+        dependencies: ["oauth-accounts"],
+        tables: ["auth_oauth_provider_token_vault"],
+    },
+    {
+        id: "permissions",
+        description: "Permission, role, and grant definitions.",
+        dependencies: [],
+        tables: [
+            "auth_permission_definition",
+            "auth_role_definition",
+            "auth_permission_grant",
+            "auth_role_grant",
+            "auth_role_permission",
+        ],
+    },
+];
+export const storageFeatureCatalog = [
+    {
+        id: "password",
+        description: "Password authentication.",
+        modules: ["credentials", "sessions", "verification"],
+    },
+    {
+        id: "email-verification",
+        description: "Email ownership verification.",
+        modules: ["verification"],
+    },
+    {
+        id: "email-otp",
+        description: "Email one-time passwords.",
+        modules: ["sessions", "verification"],
+    },
+    {
+        id: "magic-link",
+        description: "Email magic links.",
+        modules: ["sessions", "verification"],
+    },
+    {
+        id: "sessions",
+        description: "Cookie or token-backed sessions.",
+        modules: ["sessions"],
+    },
+    {
+        id: "login-approval",
+        description: "Out-of-band login approvals.",
+        modules: ["sessions", "login-approval"],
+    },
+    {
+        id: "trusted-devices",
+        description: "Trusted-device recognition.",
+        modules: ["trusted-devices"],
+    },
+    {
+        id: "passkeys",
+        description: "Passkey authentication.",
+        modules: ["sessions", "verification", "passkeys"],
+    },
+    {
+        id: "totp",
+        description: "TOTP multi-factor authentication.",
+        modules: ["sessions", "verification", "totp"],
+    },
+    {
+        id: "recovery-codes",
+        description: "MFA recovery codes.",
+        modules: ["sessions", "verification", "recovery-codes"],
+    },
+    {
+        id: "api-keys",
+        description: "User API keys.",
+        modules: ["api-keys"],
+    },
+    {
+        id: "refresh-tokens",
+        description: "Refresh-token rotation.",
+        modules: ["refresh-tokens"],
+    },
+    {
+        id: "jwt",
+        description: "JWT revocation.",
+        modules: ["jwt"],
+    },
+    {
+        id: "oauth",
+        description: "OAuth client login and account linking.",
+        modules: ["sessions", "verification", "oauth-accounts"],
+    },
+    {
+        id: "oauth-provider",
+        description: "OAuth authorization-server mode.",
+        modules: ["sessions", "oauth-provider"],
+    },
+    {
+        id: "oauth-token-vault",
+        description: "Encrypted upstream provider-token storage.",
+        modules: ["oauth-token-vault"],
+    },
+    {
+        id: "audit-log",
+        description: "Authentication audit logging.",
+        modules: ["audit-log"],
+    },
+    {
+        id: "login-risk",
+        description: "Login risk history.",
+        modules: ["login-risk"],
+    },
+    {
+        id: "security-timeline",
+        description: "User security timelines.",
+        modules: ["security-timeline"],
+    },
+    {
+        id: "webhooks",
+        description: "Reliable webhook delivery.",
+        modules: ["webhooks"],
+    },
+    {
+        id: "domain-verification",
+        description: "Domain ownership verification.",
+        modules: ["domain-verification"],
+    },
+    {
+        id: "permissions",
+        description: "Roles and permissions.",
+        modules: ["permissions"],
+    },
+];
+export const storageSchemaGeneratorCatalog = {
+    apiVersion: storageSchemaGeneratorApiVersion,
+    generatorVersion: storageSchemaGeneratorVersion,
+    schemaVersion: storageSchemaVersion,
+    schemaVersions: storageSchemaVersions,
+    databases: supportedStorageDatabases,
+    adapters: supportedStorageAdapters,
+    databaseAdapters: storageDatabaseAdapters,
+    adapterOutputs: {
+        "effect-qb": ["migration-sql", "development-seed"],
+        drizzle: ["migration-sql", "drizzle-schema", "development-seed"],
+    },
+    modes: supportedStorageGeneratorModes,
+    outputKinds: ["migration-sql", "drizzle-schema", "development-seed"],
+    sqlLayouts: ["single", "module"],
+    drizzleLayouts: ["single", "module", "table"],
+    developmentSeedTargets: supportedDevelopmentSeedTargets,
+    developmentSeedTargetsByDatabase,
+    developmentSeedTargetsByDatabaseAdapter,
+    developmentSeedComplexities: supportedDevelopmentSeedComplexities,
+    features: storageFeatureCatalog,
+    modules: storageModuleCatalog,
+};
+export class StorageSchemaGeneratorError extends Error {
+    name = "StorageSchemaGeneratorError";
+    code;
+    path;
+    suggestions;
+    constructor(code, path, message, suggestions = []) {
+        super(message);
+        this.code = code;
+        this.path = path;
+        this.suggestions = suggestions;
+    }
+    toJSON() {
+        return {
+            name: this.name,
+            code: this.code,
+            path: this.path,
+            message: this.message,
+            suggestions: this.suggestions,
+        };
+    }
+}
+const moduleById = new Map(storageModuleCatalog.map((entry) => [entry.id, entry]));
+const featureById = new Map(storageFeatureCatalog.map((feature) => [feature.id, feature]));
+const moduleOrder = new Map(storageModuleCatalog.map((entry, index) => [entry.id, index]));
+const featureOrder = new Map(storageFeatureCatalog.map((feature, index) => [feature.id, index]));
+const tableModule = new Map();
+for (const entry of storageModuleCatalog) {
+    for (const table of entry.tables) {
+        tableModule.set(table, entry.id);
+    }
+}
+const splitSqlStatements = (sql) => {
+    const statements = [];
+    let start = 0;
+    let singleQuoted = false;
+    let doubleQuoted = false;
+    for (let index = 0; index < sql.length; index += 1) {
+        const character = sql[index];
+        const next = sql[index + 1];
+        if (character === "'" && !doubleQuoted) {
+            if (singleQuoted && next === "'") {
+                index += 1;
+            }
+            else {
+                singleQuoted = !singleQuoted;
+            }
+        }
+        else if (character === '"' && !singleQuoted) {
+            if (doubleQuoted && next === '"') {
+                index += 1;
+            }
+            else {
+                doubleQuoted = !doubleQuoted;
+            }
+        }
+        else if (character === ";" && !singleQuoted && !doubleQuoted) {
+            const statement = sql.slice(start, index).trim();
+            if (statement.length > 0) {
+                statements.push(`${statement};`);
+            }
+            start = index + 1;
+        }
+    }
+    const remainder = sql.slice(start).trim();
+    if (remainder.length > 0) {
+        statements.push(remainder.endsWith(";") ? remainder : `${remainder};`);
+    }
+    return statements;
+};
+const buildCanonicalTables = (database, sqlSources) => {
+    const creates = new Map();
+    const indexes = new Map();
+    let order = 0;
+    for (const sql of sqlSources) {
+        for (const statement of splitSqlStatements(sql)) {
+            const createMatch = /^create table (?:if not exists )?([a-z0-9_]+)\s*\(/i.exec(statement);
+            if (createMatch?.[1] !== undefined) {
+                creates.set(createMatch[1], { sql: statement, order });
+                indexes.set(createMatch[1], []);
+                order += 1;
+                continue;
+            }
+            const indexMatch = /^create (?:unique )?index (?:if not exists )?[a-z0-9_]+\s+on ([a-z0-9_]+)\s*\(/i.exec(statement);
+            if (indexMatch?.[1] !== undefined) {
+                const tableIndexes = indexes.get(indexMatch[1]);
+                if (tableIndexes === undefined) {
+                    throw new Error(`Index references unknown canonical table ${indexMatch[1]}`);
+                }
+                tableIndexes.push(statement);
+            }
+        }
+    }
+    const oauthClient = creates.get("auth_oauth_client");
+    if (database === "postgres" && oauthClient !== undefined) {
+        const previous = '@ != "client_credentials"))\'))';
+        const replacement = '@ != "client_credentials" && @ != "urn:ietf:params:oauth:grant-type:device_code"))\'))';
+        const sql = oauthClient.sql.replace(previous, replacement);
+        if (sql === oauthClient.sql) {
+            throw new Error("Unable to apply the OAuth device-code grant constraint");
+        }
+        creates.set("auth_oauth_client", { ...oauthClient, sql });
+    }
+    const result = [];
+    for (const [name, create] of creates) {
+        const moduleId = tableModule.get(name);
+        if (moduleId === undefined) {
+            throw new Error(`Canonical table ${name} is missing from the module catalog`);
+        }
+        result.push({
+            name: name,
+            module: moduleId,
+            order: create.order,
+            createTable: create.sql,
+            indexes: indexes.get(name) ?? [],
+        });
+    }
+    for (const table of tableModule.keys()) {
+        if (!creates.has(table)) {
+            throw new Error(`Catalog table ${table} is missing from canonical migrations`);
+        }
+    }
+    // oxlint-disable-next-line unicorn/no-array-sort -- ES2023 toSorted is outside the supported target.
+    return result.sort((left, right) => left.order - right.order);
+};
+const canonicalTablesByDatabase = {
+    postgres: buildCanonicalTables("postgres", postgresAuthStorageMigrations.map((migration) => migration.sql)),
+    sqlite: buildCanonicalTables("sqlite", [sqliteAuthStorageSchema]),
+};
+const canonicalTables = canonicalTablesByDatabase.postgres;
+const splitTopLevel = (value) => {
+    const parts = [];
+    let depth = 0;
+    let start = 0;
+    let singleQuoted = false;
+    let doubleQuoted = false;
+    for (let index = 0; index < value.length; index += 1) {
+        const character = value[index];
+        const next = value[index + 1];
+        if (character === "'" && !doubleQuoted) {
+            if (singleQuoted && next === "'") {
+                index += 1;
+            }
+            else {
+                singleQuoted = !singleQuoted;
+            }
+        }
+        else if (character === '"' && !singleQuoted) {
+            if (doubleQuoted && next === '"') {
+                index += 1;
+            }
+            else {
+                doubleQuoted = !doubleQuoted;
+            }
+        }
+        else if (!singleQuoted && !doubleQuoted) {
+            if (character === "(") {
+                depth += 1;
+            }
+            else if (character === ")") {
+                depth -= 1;
+            }
+            else if (character === "," && depth === 0) {
+                parts.push(value.slice(start, index).trim());
+                start = index + 1;
+            }
+        }
+    }
+    parts.push(value.slice(start).trim());
+    return parts.filter((part) => part.length > 0);
+};
+// oxlint-disable-next-line eslint/complexity -- one pass handles both dialects' column and constraint syntax
+const parseCanonicalTable = (canonical) => {
+    const tableMatch = /^create table (?:if not exists )?[a-z0-9_]+\s*\(([\s\S]*)\);$/i.exec(canonical.createTable);
+    if (tableMatch?.[1] === undefined) {
+        throw new Error(`Unable to parse canonical table ${canonical.name}`);
+    }
+    const columns = [];
+    const constraints = [];
+    for (const definition of splitTopLevel(tableMatch[1])) {
+        const constraintMatch = /^constraint ([a-z0-9_]+)\s+(primary key|unique|check)\s*\(([\s\S]*)\)$/i.exec(definition);
+        if (constraintMatch !== null) {
+            const [, name, rawKind, value] = constraintMatch;
+            if (name === undefined || rawKind === undefined || value === undefined) {
+                throw new Error(`Unable to parse constraint in ${canonical.name}`);
+            }
+            const kind = rawKind.toLowerCase();
+            constraints.push(kind === "check"
+                ? { name, kind: "check", expression: value.trim() }
+                : {
+                    name,
+                    kind: kind === "unique" ? "unique" : "primary-key",
+                    columns: splitTopLevel(value).map((column) => column.trim().split(/\s+/u)[0].toLowerCase()),
+                });
+            continue;
+        }
+        const primaryKeyMatch = /^primary key\s*\(([\s\S]*)\)$/i.exec(definition);
+        if (primaryKeyMatch?.[1] !== undefined) {
+            constraints.push({
+                name: `${canonical.name}_pkey`,
+                kind: "primary-key",
+                columns: splitTopLevel(primaryKeyMatch[1]).map((column) => column.trim().split(/\s+/u)[0].toLowerCase()),
+            });
+            continue;
+        }
+        const tableCheckMatch = /^check\s*\(([\s\S]*)\)$/i.exec(definition);
+        if (tableCheckMatch?.[1] !== undefined) {
+            constraints.push({
+                name: `${canonical.name}_state_check`,
+                kind: "check",
+                expression: tableCheckMatch[1].trim(),
+            });
+            continue;
+        }
+        const columnMatch = /^([a-z0-9_]+)\s+(text|bigint|integer|boolean|jsonb)\b([\s\S]*)$/i.exec(definition);
+        if (columnMatch === null) {
+            throw new Error(`Unable to parse column definition in ${canonical.name}: ${definition}`);
+        }
+        const [, name, rawType, modifiers = ""] = columnMatch;
+        if (name === undefined || rawType === undefined) {
+            throw new Error(`Unable to parse column in ${canonical.name}`);
+        }
+        const inlinePrimaryKey = /\bprimary key\b/i.test(modifiers);
+        const namedPrimaryKey = /constraint ([a-z0-9_]+) primary key/i.exec(modifiers)?.[1];
+        if (inlinePrimaryKey) {
+            constraints.push({
+                name: namedPrimaryKey ?? `${canonical.name}_pkey`,
+                kind: "primary-key",
+                columns: [name],
+            });
+        }
+        if (/\bunique\b/i.test(modifiers)) {
+            constraints.push({
+                name: `${canonical.name}_${name}_key`,
+                kind: "unique",
+                columns: [name],
+            });
+        }
+        const inlineCheck = /\bcheck\s*\(([\s\S]*)\)\s*$/i.exec(modifiers);
+        if (inlineCheck?.[1] !== undefined) {
+            constraints.push({
+                name: `${canonical.name}_${name}_check`,
+                kind: "check",
+                expression: inlineCheck[1].trim(),
+            });
+        }
+        const defaultMatch = /\bdefault\s+(false|true|-?\d+|'(?:''|[^'])*')/i.exec(modifiers);
+        const defaultValue = defaultMatch?.[1];
+        columns.push({
+            name,
+            type: rawType.toLowerCase(),
+            notNull: /\bnot null\b/i.test(modifiers) || inlinePrimaryKey,
+            defaultValue: defaultValue === undefined
+                ? undefined
+                : /^(?:false|true)$/iu.test(defaultValue)
+                    ? defaultValue.toLowerCase()
+                    : defaultValue,
+            identity: /\bgenerated always as identity\b/i.test(modifiers),
+            autoincrement: /\bautoincrement\b/i.test(modifiers),
+            collateC: /\bcollate "C"/i.test(modifiers),
+        });
+    }
+    return { canonical, columns, constraints };
+};
+const parsedTableByDatabase = {
+    postgres: new Map(canonicalTablesByDatabase.postgres.map((table) => [
+        table.name,
+        parseCanonicalTable(table),
+    ])),
+    sqlite: new Map(canonicalTablesByDatabase.sqlite.map((table) => [
+        table.name,
+        parseCanonicalTable(table),
+    ])),
+};
+const compareByOrder = (order) => (left, right) => (order.get(left) ?? Number.MAX_SAFE_INTEGER) -
+    (order.get(right) ?? Number.MAX_SAFE_INTEGER);
+const resolveModules = (directModules) => {
+    const resolved = new Set();
+    const include = (moduleId) => {
+        if (resolved.has(moduleId)) {
+            return;
+        }
+        const moduleEntry = moduleById.get(moduleId);
+        if (moduleEntry === undefined) {
+            throw new Error(`Unknown catalog module ${moduleId}`);
+        }
+        for (const dependency of moduleEntry.dependencies) {
+            include(dependency);
+        }
+        resolved.add(moduleId);
+    };
+    for (const moduleId of directModules) {
+        include(moduleId);
+    }
+    // oxlint-disable-next-line unicorn/no-array-sort -- ES2023 toSorted is outside the supported target.
+    return [...resolved].sort(compareByOrder(moduleOrder));
+};
+export const resolveStorageFeatures = (features) => {
+    // oxlint-disable-next-line unicorn/no-array-sort -- ES2023 toSorted is outside the supported target.
+    const normalizedFeatures = [...new Set(features)].sort(compareByOrder(featureOrder));
+    const directModules = new Set();
+    for (const featureId of normalizedFeatures) {
+        const feature = featureById.get(featureId);
+        if (feature === undefined) {
+            throw new StorageSchemaGeneratorError("UNKNOWN_FEATURE", "features", `Unsupported storage feature ${JSON.stringify(featureId)}.`, storageFeatureCatalog.map((entry) => entry.id));
+        }
+        for (const moduleId of feature.modules) {
+            directModules.add(moduleId);
+        }
+    }
+    const modules = resolveModules(directModules);
+    const selectedModules = new Set(modules);
+    const tables = canonicalTables
+        .filter((table) => selectedModules.has(table.module))
+        .map((table) => table.name);
+    return {
+        features: normalizedFeatures,
+        modules,
+        tables,
+        impliedModules: modules.filter((moduleId) => !directModules.has(moduleId)),
+    };
+};
+const includeDevelopmentSeedRequirements = (selection) => {
+    if (selection.modules.includes("core")) {
+        return selection;
+    }
+    const modules = resolveModules(new Set([...selection.modules, "core"]));
+    const selectedModules = new Set(modules);
+    return {
+        ...selection,
+        modules,
+        tables: canonicalTables
+            .filter((table) => selectedModules.has(table.module))
+            .map((table) => table.name),
+        impliedModules: [...selection.impliedModules, "core"],
+    };
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const assertKnownKeys = (value, keys, path, code) => {
+    const allowed = new Set(keys);
+    for (const key of Object.keys(value)) {
+        if (!allowed.has(key)) {
+            throw new StorageSchemaGeneratorError(code, path === "$" ? key : `${path}.${key}`, `Unknown property ${JSON.stringify(key)}.`, keys);
+        }
+    }
+};
+// oxlint-disable-next-line eslint/complexity -- validation keeps precise error paths in one pass
+const normalizeRequest = (input) => {
+    if (!isRecord(input)) {
+        throw new StorageSchemaGeneratorError("INVALID_REQUEST", "$", "The generator request must be an object.");
+    }
+    const request = input;
+    assertKnownKeys(request, ["database", "adapter", "mode", "features", "outputs"], "$", "INVALID_REQUEST");
+    if (request.database !== "postgres" && request.database !== "sqlite") {
+        throw new StorageSchemaGeneratorError("UNSUPPORTED_DATABASE", "database", `Unsupported database ${JSON.stringify(request.database)}.`, supportedStorageDatabases);
+    }
+    const { database } = request;
+    if (request.adapter !== "effect-qb" && request.adapter !== "drizzle") {
+        throw new StorageSchemaGeneratorError("UNSUPPORTED_ADAPTER", "adapter", `Unsupported adapter ${JSON.stringify(request.adapter)}.`, supportedStorageAdapters);
+    }
+    const { adapter } = request;
+    if (request.mode !== undefined && request.mode !== "fresh") {
+        throw new StorageSchemaGeneratorError("UNSUPPORTED_MODE", "mode", `Unsupported generation mode ${JSON.stringify(request.mode)}.`, ["fresh"]);
+    }
+    if (!Array.isArray(request.features) || request.features.length === 0) {
+        throw new StorageSchemaGeneratorError("INVALID_REQUEST", "features", "At least one storage feature is required.", storageFeatureCatalog.map((feature) => feature.id));
+    }
+    const features = [];
+    for (const [index, feature] of request.features.entries()) {
+        if (typeof feature !== "string" ||
+            !featureById.has(feature)) {
+            throw new StorageSchemaGeneratorError("UNKNOWN_FEATURE", `features[${index}]`, `Unsupported storage feature ${JSON.stringify(feature)}.`, storageFeatureCatalog.map((entry) => entry.id));
+        }
+        features.push(feature);
+    }
+    if (!Array.isArray(request.outputs) || request.outputs.length === 0) {
+        throw new StorageSchemaGeneratorError("INVALID_REQUEST", "outputs", "At least one output is required.", ["migration-sql", "drizzle-schema", "development-seed"]);
+    }
+    const outputs = [];
+    const outputKinds = new Set();
+    for (const [index, output] of request.outputs.entries()) {
+        const path = `outputs[${index}]`;
+        if (!isRecord(output)) {
+            throw new StorageSchemaGeneratorError("INVALID_OUTPUT", path, "Each output must be an object.");
+        }
+        if (output.kind === "migration-sql") {
+            assertKnownKeys(output, ["kind", "layout"], path, "INVALID_OUTPUT");
+            if (output.layout !== "single" && output.layout !== "module") {
+                throw new StorageSchemaGeneratorError("INVALID_OUTPUT", `${path}.layout`, `Invalid migration SQL layout ${JSON.stringify(output.layout)}.`, ["single", "module"]);
+            }
+            outputs.push({ kind: "migration-sql", layout: output.layout });
+        }
+        else if (output.kind === "drizzle-schema") {
+            assertKnownKeys(output, ["kind", "layout", "includeRelations"], path, "INVALID_OUTPUT");
+            if (output.layout !== "single" &&
+                output.layout !== "module" &&
+                output.layout !== "table") {
+                throw new StorageSchemaGeneratorError("INVALID_OUTPUT", `${path}.layout`, `Invalid Drizzle schema layout ${JSON.stringify(output.layout)}.`, ["single", "module", "table"]);
+            }
+            if (output.includeRelations !== undefined &&
+                typeof output.includeRelations !== "boolean") {
+                throw new StorageSchemaGeneratorError("INVALID_OUTPUT", `${path}.includeRelations`, "includeRelations must be a boolean.");
+            }
+            outputs.push({
+                kind: "drizzle-schema",
+                layout: output.layout,
+                includeRelations: output.includeRelations === true,
+            });
+        }
+        else if (output.kind === "development-seed") {
+            assertKnownKeys(output, ["kind", "target", "complexity"], path, "INVALID_OUTPUT");
+            if (typeof output.target !== "string" ||
+                !supportedDevelopmentSeedTargets.includes(output.target)) {
+                throw new StorageSchemaGeneratorError("INVALID_OUTPUT", `${path}.target`, `Invalid development seed target ${JSON.stringify(output.target)}.`, supportedDevelopmentSeedTargets);
+            }
+            if (!developmentSeedTargetsByDatabaseAdapter[database][adapter].includes(output.target)) {
+                throw new StorageSchemaGeneratorError("INVALID_OUTPUT", `${path}.target`, `Development seed target ${JSON.stringify(output.target)} is not available for ${database}.`, developmentSeedTargetsByDatabaseAdapter[database][adapter]);
+            }
+            if (output.complexity !== undefined &&
+                output.complexity !== "medium" &&
+                output.complexity !== "low") {
+                throw new StorageSchemaGeneratorError("INVALID_OUTPUT", `${path}.complexity`, `Invalid development seed complexity ${JSON.stringify(output.complexity)}.`, supportedDevelopmentSeedComplexities);
+            }
+            outputs.push({
+                kind: "development-seed",
+                target: output.target,
+                complexity: output.complexity ??
+                    "medium",
+            });
+        }
+        else {
+            throw new StorageSchemaGeneratorError("INVALID_OUTPUT", `${path}.kind`, `Unsupported output kind ${JSON.stringify(output.kind)}.`, ["migration-sql", "drizzle-schema", "development-seed"]);
+        }
+        if (outputKinds.has(output.kind)) {
+            throw new StorageSchemaGeneratorError("DUPLICATE_OUTPUT", `${path}.kind`, `Only one ${String(output.kind)} output may be requested.`, ["Combine the requested files by choosing one layout."]);
+        }
+        outputKinds.add(output.kind);
+    }
+    if (adapter === "effect-qb") {
+        const unsupportedOutputIndex = outputs.findIndex((output) => output.kind === "drizzle-schema");
+        if (unsupportedOutputIndex !== -1) {
+            throw new StorageSchemaGeneratorError("UNSUPPORTED_OUTPUT_FOR_ADAPTER", `outputs[${unsupportedOutputIndex}].kind`, "The effect-qb adapter owns its table declarations and does not generate a Drizzle schema.", ["migration-sql", "development-seed"]);
+        }
+    }
+    // oxlint-disable-next-line unicorn/no-array-sort -- ES2023 toSorted is outside the supported target.
+    outputs.sort((left, right) => {
+        if (left.kind !== right.kind) {
+            const order = new Map([
+                ["migration-sql", 0],
+                ["drizzle-schema", 1],
+                ["development-seed", 2],
+            ]);
+            return (order.get(left.kind) ?? 3) - (order.get(right.kind) ?? 3);
+        }
+        if (left.kind === "development-seed") {
+            return left.target.localeCompare(right.target);
+        }
+        return left.layout.localeCompare(right.layout);
+    });
+    return {
+        database,
+        adapter,
+        mode: "fresh",
+        // oxlint-disable-next-line unicorn/no-array-sort -- ES2023 toSorted is outside the supported target.
+        features: [...new Set(features)].sort(compareByOrder(featureOrder)),
+        outputs,
+    };
+};
+const renderCanonicalSql = (tables) => `${tables
+    .flatMap((table) => [table.createTable, ...table.indexes])
+    .join("\n\n")}
+`;
+const sqlFiles = (database, layout, selection) => {
+    const selectedTables = new Set(selection.tables);
+    const tables = canonicalTablesByDatabase[database].filter((table) => selectedTables.has(table.name));
+    if (layout === "single") {
+        return [
+            {
+                path: "effect-auth.sql",
+                mediaType: "application/sql",
+                content: renderCanonicalSql(tables),
+            },
+        ];
+    }
+    return selection.modules.map((moduleId, index) => ({
+        path: `${String(index + 1).padStart(4, "0")}_effect_auth_${moduleId.replaceAll("-", "_")}.sql`,
+        mediaType: "application/sql",
+        content: renderCanonicalSql(tables.filter((table) => table.module === moduleId)),
+    }));
+};
+const camelCase = (value) => value.replaceAll(/_([a-z0-9])/g, (_, character) => character.toUpperCase());
+const kebabCase = (value) => value.replaceAll("_", "-");
+const escapeTemplate = (value) => value.replaceAll("`", "\\`").replaceAll("${", "\\${");
+const renderColumn = (column, database) => {
+    let expression;
+    if (database === "sqlite") {
+        expression = `${column.type === "integer" ? "integer" : "text"}(${JSON.stringify(column.name)})`;
+    }
+    else {
+        switch (column.type) {
+            case "bigint": {
+                expression = `bigint(${JSON.stringify(column.name)}, { mode: "number" })`;
+                break;
+            }
+            case "boolean": {
+                expression = `boolean(${JSON.stringify(column.name)})`;
+                break;
+            }
+            case "integer": {
+                expression = `integer(${JSON.stringify(column.name)})`;
+                break;
+            }
+            case "jsonb": {
+                expression = `jsonb(${JSON.stringify(column.name)})`;
+                break;
+            }
+            case "text": {
+                expression = `${column.collateC ? "textC" : "text"}(${JSON.stringify(column.name)})`;
+                break;
+            }
+        }
+    }
+    if (column.autoincrement) {
+        expression += ".primaryKey({ autoIncrement: true })";
+    }
+    else if (column.identity) {
+        expression += ".generatedAlwaysAsIdentity()";
+    }
+    if (column.notNull && !column.identity && !column.autoincrement) {
+        expression += ".notNull()";
+    }
+    if (column.defaultValue !== undefined) {
+        const defaultValue = column.defaultValue.startsWith("'")
+            ? JSON.stringify(column.defaultValue.slice(1, -1).replaceAll("''", "'"))
+            : column.defaultValue;
+        expression += `.default(${defaultValue})`;
+    }
+    return `    ${camelCase(column.name)}: ${expression},`;
+};
+const renderSqlTemplate = (value) => `sql\`${escapeTemplate(value)}\``;
+const renderIndexColumn = (value) => {
+    const match = /^([a-z0-9_]+)(?:\s+collate\s+"C")?$/i.exec(value.trim());
+    if (match?.[1] === undefined) {
+        return renderSqlTemplate(value.trim());
+    }
+    const column = camelCase(match[1]);
+    return /\bcollate\s+"C"/i.test(value)
+        ? `sql\`\${t.${column}} collate "C"\``
+        : `t.${column}`;
+};
+const renderIndex = (statement) => {
+    const match = /^create (unique )?index (?:if not exists )?([a-z0-9_]+)\s+on [a-z0-9_]+\s*\(([\s\S]*?)\)(?:\s+where\s+([\s\S]+?))?;$/i.exec(statement);
+    if (match === null || match[2] === undefined || match[3] === undefined) {
+        throw new Error(`Unable to render canonical index: ${statement}`);
+    }
+    const [, uniqueMarker, name, columns, where] = match;
+    let expression = `${uniqueMarker === undefined ? "index" : "uniqueIndex"}(${JSON.stringify(name)}).on(${splitTopLevel(columns).map(renderIndexColumn).join(", ")})`;
+    if (where !== undefined) {
+        expression += `.where(${renderSqlTemplate(where.trim())})`;
+    }
+    return `    ${expression},`;
+};
+const renderConstraint = (constraint) => {
+    switch (constraint.kind) {
+        case "check": {
+            return `    check(${JSON.stringify(constraint.name)}, ${renderSqlTemplate(constraint.expression ?? "")}),`;
+        }
+        case "primary-key": {
+            return `    primaryKey({ name: ${JSON.stringify(constraint.name)}, columns: [${(constraint.columns ?? [])
+                .map((column) => `t.${camelCase(column)}`)
+                .join(", ")}] }),`;
+        }
+        case "unique": {
+            return `    unique(${JSON.stringify(constraint.name)}).on(${(constraint.columns ?? [])
+                .map((column) => `t.${camelCase(column)}`)
+                .join(", ")}),`;
+        }
+    }
+};
+const isAutoincrementPrimaryKey = (table, constraint) => constraint.kind === "primary-key" &&
+    constraint.columns?.some((columnName) => table.columns.some((column) => column.name === columnName && column.autoincrement)) === true;
+const drizzleImports = (database, tables) => {
+    const imports = new Set([
+        database === "postgres" ? "pgTable" : "sqliteTable",
+    ]);
+    for (const table of tables) {
+        for (const column of table.columns) {
+            imports.add(database === "sqlite"
+                ? column.type === "integer"
+                    ? "integer"
+                    : "text"
+                : column.type);
+            if (database === "postgres" && column.collateC) {
+                imports.add("customType");
+            }
+        }
+        for (const constraint of table.constraints) {
+            if (isAutoincrementPrimaryKey(table, constraint)) {
+                continue;
+            }
+            imports.add(constraint.kind === "primary-key"
+                ? "primaryKey"
+                : constraint.kind === "unique"
+                    ? "unique"
+                    : "check");
+            if (constraint.kind === "check") {
+                imports.add("sql");
+            }
+        }
+        for (const statement of table.canonical.indexes) {
+            imports.add(/^create unique index/i.test(statement) ? "uniqueIndex" : "index");
+            if (/\bwhere\b|\bcollate\b/i.test(statement)) {
+                imports.add("sql");
+            }
+        }
+    }
+    // oxlint-disable-next-line unicorn/no-array-sort -- ES2023 toSorted is outside the supported target.
+    return [...imports].sort();
+};
+const renderTable = (database, table) => {
+    const variable = camelCase(table.canonical.name);
+    const extras = [
+        ...table.constraints
+            .filter((constraint) => !isAutoincrementPrimaryKey(table, constraint))
+            .map(renderConstraint),
+        ...table.canonical.indexes.map(renderIndex),
+    ];
+    return `export const ${variable} = ${database === "postgres" ? "pgTable" : "sqliteTable"}(
+  ${JSON.stringify(table.canonical.name)},
+  {
+${table.columns.map((column) => renderColumn(column, database)).join("\n")}
+  },
+  (t) => [
+${extras.join("\n")}
+  ]
+);`;
+};
+const renderDrizzleTables = (database, tables) => {
+    const imports = drizzleImports(database, tables);
+    const usesSql = imports.includes("sql");
+    const databaseImports = imports.filter((name) => name !== "sql");
+    const importLines = [
+        ...(usesSql ? ['import { sql } from "drizzle-orm";'] : []),
+        `import { ${databaseImports.join(", ")} } from "drizzle-orm/${database === "postgres" ? "pg-core" : "sqlite-core"}";`,
+    ];
+    const collatedText = database === "postgres" &&
+        tables.some((table) => table.columns.some((column) => column.collateC))
+        ? `
+const textC = customType<{ data: string }>({
+  dataType: () => 'text collate "C"',
+});`
+        : "";
+    return `${importLines.join("\n")}${collatedText}
+
+${tables.map((table) => renderTable(database, table)).join("\n\n")}
+`;
+};
+// oxlint-disable-next-line eslint/complexity -- each branch describes one canonical relation family
+const logicalRelations = (tables) => {
+    const byName = new Map(tables.map((table) => [table.canonical.name, table]));
+    const relations = [];
+    const addRelation = (sourceTable, sourceColumnName, targetTable, targetColumnName, name) => {
+        const source = byName.get(sourceTable);
+        const target = byName.get(targetTable);
+        const sourceColumn = source?.columns.find((column) => column.name === sourceColumnName);
+        const targetColumn = target?.columns.find((column) => column.name === targetColumnName);
+        if (source !== undefined &&
+            target !== undefined &&
+            sourceColumn !== undefined &&
+            targetColumn !== undefined) {
+            relations.push({ source, sourceColumn, target, targetColumn, name });
+        }
+    };
+    const user = byName.get("auth_user");
+    const userId = user?.columns.find((column) => column.name === "id");
+    if (user !== undefined && userId !== undefined) {
+        for (const table of tables) {
+            for (const column of table.columns) {
+                if (table !== user && column.name.endsWith("user_id")) {
+                    const prefix = column.name
+                        .slice(0, -"user_id".length)
+                        .replace(/_$/, "");
+                    relations.push({
+                        source: table,
+                        sourceColumn: column,
+                        target: user,
+                        targetColumn: userId,
+                        name: prefix.length === 0 ? "user" : `${camelCase(prefix)}User`,
+                    });
+                }
+            }
+        }
+    }
+    const oauthClient = byName.get("auth_oauth_client");
+    const oauthClientId = oauthClient?.columns.find((column) => column.name === "id");
+    if (oauthClient !== undefined && oauthClientId !== undefined) {
+        for (const tableName of [
+            "auth_oauth_consent",
+            "auth_oauth_authorization_code",
+            "auth_oauth_device_authorization",
+            "auth_oauth_client_secret",
+            "auth_oauth_provider_mode_token",
+        ]) {
+            const source = byName.get(tableName);
+            const sourceColumn = source?.columns.find((column) => column.name === "client_id");
+            if (source !== undefined && sourceColumn !== undefined) {
+                relations.push({
+                    source,
+                    sourceColumn,
+                    target: oauthClient,
+                    targetColumn: oauthClientId,
+                    name: "client",
+                });
+            }
+        }
+    }
+    const oauthAccount = byName.get("auth_oauth_account");
+    const oauthAccountId = oauthAccount?.columns.find((column) => column.name === "id");
+    const vault = byName.get("auth_oauth_provider_token_vault");
+    const vaultAccountId = vault?.columns.find((column) => column.name === "account_id");
+    if (oauthAccount !== undefined &&
+        oauthAccountId !== undefined &&
+        vault !== undefined &&
+        vaultAccountId !== undefined) {
+        relations.push({
+            source: vault,
+            sourceColumn: vaultAccountId,
+            target: oauthAccount,
+            targetColumn: oauthAccountId,
+            name: "account",
+        });
+    }
+    addRelation("auth_user_identity", "replaced_by_id", "auth_user_identity", "id", "replacedBy");
+    addRelation("auth_refresh_token", "replaced_by_id", "auth_refresh_token", "id", "replacedBy");
+    addRelation("auth_login_approval_review", "approval_challenge_id", "auth_verification", "id", "challenge");
+    addRelation("auth_oauth_provider_mode_token", "replaced_by_token_hash", "auth_oauth_provider_mode_token", "token_hash", "replacedBy");
+    addRelation("auth_permission_grant", "permission_id", "auth_permission_definition", "id", "permission");
+    addRelation("auth_role_grant", "role_id", "auth_role_definition", "id", "role");
+    addRelation("auth_role_permission", "role_id", "auth_role_definition", "id", "role");
+    addRelation("auth_role_permission", "permission_id", "auth_permission_definition", "id", "permission");
+    return relations;
+};
+const renderRelations = (database, tables, schemaExpression, importPath) => {
+    const relations = logicalRelations(tables);
+    const grouped = new Map();
+    for (const relation of relations) {
+        const existing = grouped.get(relation.source) ?? [];
+        existing.push(relation);
+        grouped.set(relation.source, existing);
+    }
+    const entries = [...grouped.entries()].map(([table, tableRelations]) => {
+        const sourceName = camelCase(table.canonical.name);
+        return `  ${sourceName}: {
+${tableRelations
+            .map((relation) => {
+            const targetName = camelCase(relation.target.canonical.name);
+            return `    ${relation.name}: r.one.${targetName}({
+      from: r.${sourceName}.${camelCase(relation.sourceColumn.name)},
+      to: r.${targetName}.${camelCase(relation.targetColumn.name)},
+    }),`;
+        })
+            .join("\n")}
+  },`;
+    });
+    const imports = [
+        'import { defineRelations } from "drizzle-orm";',
+        ...(importPath === undefined
+            ? []
+            : [`import * as schema from ${JSON.stringify(importPath)};`]),
+    ];
+    return `${imports.join("\n")}
+
+// Drizzle relations are application-level only and do not create ${database === "postgres" ? "PostgreSQL" : "SQLite"} foreign keys.
+export const relations = defineRelations(${schemaExpression}, (r) => ({
+${entries.join("\n")}
+}));
+`;
+};
+const exportFile = (paths) => `${paths.map((path) => `export * from ${JSON.stringify(path)};`).join("\n")}
+`;
+const drizzleFiles = (database, layout, includeRelations, selection) => {
+    const selected = new Set(selection.tables);
+    const tables = canonicalTablesByDatabase[database]
+        .filter((table) => selected.has(table.name))
+        .map((table) => parsedTableByDatabase[database].get(table.name));
+    if (layout === "single") {
+        let content = renderDrizzleTables(database, tables);
+        if (includeRelations) {
+            const schema = `{ ${tables
+                .map((table) => camelCase(table.canonical.name))
+                .join(", ")} }`;
+            content += `\n${renderRelations(database, tables, schema)}`;
+        }
+        return [{ path: "schema.ts", mediaType: "text/typescript", content }];
+    }
+    const directory = layout === "module" ? "modules" : "tables";
+    const groups = layout === "module"
+        ? selection.modules.map((moduleId) => ({
+            name: moduleId,
+            tables: tables.filter((table) => table.canonical.module === moduleId),
+        }))
+        : tables.map((table) => ({
+            name: kebabCase(table.canonical.name),
+            tables: [table],
+        }));
+    const files = groups.map((group) => ({
+        path: `${directory}/${group.name}.ts`,
+        mediaType: "text/typescript",
+        content: renderDrizzleTables(database, group.tables),
+    }));
+    files.push({
+        path: `${directory}/index.ts`,
+        mediaType: "text/typescript",
+        content: exportFile(groups.map((group) => `./${group.name}.js`)),
+    });
+    if (includeRelations) {
+        files.push({
+            path: "relations.ts",
+            mediaType: "text/typescript",
+            content: renderRelations(database, tables, "schema", `./${directory}/index.js`),
+        });
+    }
+    files.push({
+        path: "index.ts",
+        mediaType: "text/typescript",
+        content: exportFile([
+            `./${directory}/index.js`,
+            ...(includeRelations ? ["./relations.js"] : []),
+        ]),
+    });
+    return files;
+};
+const developmentSeedCoreImports = (includePassword) => `import {
+  DevelopmentSeed,
+  DevelopmentSeedLive,
+} from "@effect-auth/core/DevelopmentSeed";
+import { IdentityKindRegistryDefaultLive } from "@effect-auth/core/Identity";
+${includePassword
+    ? `import { WebCryptoLive } from "@effect-auth/core/Crypto";
+import { Pbkdf2PasswordHasherLive } from "@effect-auth/core/Password";
+`
+    : ""}`;
+const developmentSeedDependenciesSource = (includePassword) => includePassword
+    ? `const DevelopmentSeedSupportLive = Layer.mergeAll(
+  IdentityKindRegistryDefaultLive,
+  Pbkdf2PasswordHasherLive().pipe(Layer.provide(WebCryptoLive())),
+);
+`
+    : `const DevelopmentSeedSupportLive = IdentityKindRegistryDefaultLive;
+`;
+const developmentSeedProgramSource = (includePassword) => `const developmentSeedProgram = Effect.gen(function* () {
+  const seed = yield* DevelopmentSeed;
+  const result = yield* seed.${includePassword ? "seedPasswordUsers" : "seedUsers"};
+  yield* Effect.logInfo(
+    \`Development auth seed complete: \${result.created} created, \${result.existing} existing.\`,
+  );
+  return result;
+});
+`;
+const developmentSeedConfigurationErrorSource = `export class DevelopmentSeedConfigurationError extends Data.TaggedError(
+  "DevelopmentSeedConfigurationError",
+)<{ readonly message: string }> {}
+`;
+const alchemyD1SeedSource = (adapter, includePassword, complexity) => {
+    const drizzle = adapter === "drizzle";
+    const storageModule = drizzle
+        ? "DrizzleD1SqliteStorage"
+        : "EffectQbSqliteStorage";
+    const storageType = drizzle
+        ? "DrizzleD1DatabaseLike"
+        : "D1EffectQbDatabaseLike";
+    const storageLayer = drizzle
+        ? "DrizzleD1SqliteAuthStorageLive"
+        : "D1EffectQbSqliteAuthStorageLive";
+    const medium = complexity === "medium";
+    return `import type { ${storageType} } from "@effect-auth/core/${storageModule}";
+import { ${storageLayer} } from "@effect-auth/core/${storageModule}";
+${developmentSeedCoreImports(includePassword)}import { Data, Effect, Layer } from "effect";
+
+${developmentSeedConfigurationErrorSource}
+${developmentSeedDependenciesSource(includePassword)}
+${developmentSeedProgramSource(includePassword)}
+${medium ? "export " : ""}const AppDevelopmentSeedLive = (database: ${storageType}) =>
+  DevelopmentSeedLive.pipe(
+    Layer.provideMerge(
+      Layer.mergeAll(
+        ${storageLayer}(database),
+        DevelopmentSeedSupportLive,
+      ),
+    ),
+  );
+
+${medium ? "export const runDevelopmentSeed" : "export const seedDevelopmentAuth"} = (
+  database: ${storageType},
+  isDevelopment: boolean,
+) =>
+  Effect.gen(function* () {
+    if (!isDevelopment) {
+      return yield* new DevelopmentSeedConfigurationError({
+        message: "Refusing to seed Effect Auth outside Alchemy development mode.",
+      });
+    }
+    return yield* developmentSeedProgram.pipe(
+      Effect.provide(AppDevelopmentSeedLive(database)),
+    );
+  });
+${medium
+        ? ""
+        : `
+// In alchemy.run.ts, after migrations:
+// const alchemy = yield* Alchemy.AlchemyContext;
+// yield* Database;
+// const client = yield* Cloudflare.D1.QueryDatabase(Database);
+// yield* seedDevelopmentAuth(yield* client.raw, alchemy.dev);
+`}`;
+};
+const standaloneConfigurationSource = (value) => {
+    const readValue = value === "sqlite"
+        ? 'const filename = process.env.EFFECT_AUTH_SQLITE_FILE ?? "./data/auth.sqlite";'
+        : `const databaseUrl = process.env.DATABASE_URL;
+  if (databaseUrl === undefined || databaseUrl.length === 0) {
+    return yield* new DevelopmentSeedConfigurationError({
+      message: "DATABASE_URL is required.",
+    });
+  }`;
+    const returned = value === "sqlite" ? "filename" : "databaseUrl";
+    return `const developmentSeedConfiguration = Effect.gen(function* () {
+  if (
+    process.env.NODE_ENV === "production" ||
+    process.env.EFFECT_AUTH_DEVELOPMENT_SEED !== "true"
+  ) {
+    return yield* new DevelopmentSeedConfigurationError({
+      message: "Set EFFECT_AUTH_DEVELOPMENT_SEED=true to run the development seed.",
+    });
+  }
+  ${readValue}
+  return ${returned};
+});
+`;
+};
+const sqliteSeedSource = (runtime, includePassword, complexity) => {
+    const storageModule = runtime === "bun" ? "DrizzleBunSqliteStorage" : "DrizzleNodeSqliteStorage";
+    const storageLayer = runtime === "bun"
+        ? "DrizzleBunSqliteAuthStorageLive"
+        : "DrizzleNodeSqliteAuthStorageLive";
+    const medium = complexity === "medium";
+    return `import { ${storageLayer} } from "@effect-auth/core/${storageModule}";
+${developmentSeedCoreImports(includePassword)}import { Data, Effect, Layer } from "effect";
+
+${developmentSeedConfigurationErrorSource}
+${developmentSeedDependenciesSource(includePassword)}
+${developmentSeedProgramSource(includePassword)}
+${standaloneConfigurationSource("sqlite")}
+${medium ? "export " : ""}const AppDevelopmentSeedLive = (filename: string) =>
+  DevelopmentSeedLive.pipe(
+    Layer.provideMerge(
+      Layer.mergeAll(
+        ${storageLayer}({ filename }),
+        DevelopmentSeedSupportLive,
+      ),
+    ),
+  );
+
+${medium ? "export " : ""}const runDevelopmentSeed = Effect.gen(function* () {
+  const filename = yield* developmentSeedConfiguration;
+  return yield* developmentSeedProgram.pipe(
+    Effect.provide(AppDevelopmentSeedLive(filename)),
+    Effect.scoped,
+  );
+});
+${medium ? "" : "\nawait Effect.runPromise(runDevelopmentSeed);\n"}`;
+};
+const postgresSeedSource = (adapter, includePassword, complexity) => {
+    const drizzle = adapter === "drizzle";
+    const medium = complexity === "medium";
+    const storageImports = drizzle
+        ? 'import { DrizzlePostgresAuthStorageLive } from "@effect-auth/core/DrizzlePostgresStorage";\n'
+        : `import * as PgClient from "@effect/sql-pg/PgClient";
+import { EffectQbPostgresCoreStoresLive } from "@effect-auth/core/EffectQbPostgresStorage";
+`;
+    const layerSource = drizzle
+        ? `${medium ? "export " : ""}const AppDevelopmentSeedLive = (databaseUrl: string) =>
+  DevelopmentSeedLive.pipe(
+    Layer.provideMerge(
+      Layer.mergeAll(
+        DrizzlePostgresAuthStorageLive({ url: Redacted.make(databaseUrl) }),
+        DevelopmentSeedSupportLive,
+      ),
+    ),
+  );`
+        : `${medium ? "export " : ""}const AppDevelopmentSeedLive = (sql: PgClient.PgClient) =>
+  DevelopmentSeedLive.pipe(
+    Layer.provideMerge(
+      Layer.mergeAll(
+        EffectQbPostgresCoreStoresLive(sql),
+        DevelopmentSeedSupportLive,
+      ),
+    ),
+  );`;
+    const runSource = drizzle
+        ? `const databaseUrl = yield* developmentSeedConfiguration;
+  return yield* developmentSeedProgram.pipe(
+    Effect.provide(AppDevelopmentSeedLive(databaseUrl)),
+    Effect.scoped,
+  );`
+        : `const databaseUrl = yield* developmentSeedConfiguration;
+  const PostgresClientLive = PgClient.layer({
+    url: Redacted.make(databaseUrl),
+  });
+  return yield* Effect.gen(function* () {
+    const sql = yield* PgClient.PgClient;
+    return yield* developmentSeedProgram.pipe(
+      Effect.provide(AppDevelopmentSeedLive(sql)),
+    );
+  }).pipe(Effect.provide(PostgresClientLive), Effect.scoped);`;
+    return `${storageImports}${developmentSeedCoreImports(includePassword)}import { Data, Effect, Layer, Redacted } from "effect";
+
+${developmentSeedConfigurationErrorSource}
+${developmentSeedDependenciesSource(includePassword)}
+${developmentSeedProgramSource(includePassword)}
+${standaloneConfigurationSource("postgres")}
+${layerSource}
+
+${medium ? "export " : ""}const runDevelopmentSeed = Effect.gen(function* () {
+  ${runSource}
+});
+${medium ? "" : "\nawait Effect.runPromise(runDevelopmentSeed);\n"}`;
+};
+const developmentSeedFiles = (adapter, target, includePassword, complexity) => {
+    let content;
+    switch (target) {
+        case "alchemy-d1": {
+            content = alchemyD1SeedSource(adapter, includePassword, complexity);
+            break;
+        }
+        case "bun-sqlite": {
+            content = sqliteSeedSource("bun", includePassword, complexity);
+            break;
+        }
+        case "node-sqlite": {
+            content = sqliteSeedSource("node", includePassword, complexity);
+            break;
+        }
+        case "postgres": {
+            content = postgresSeedSource(adapter, includePassword, complexity);
+            break;
+        }
+    }
+    return [{ path: "seed-auth.ts", mediaType: "text/typescript", content }];
+};
+const fingerprint = (value) => {
+    let hash = 2_166_136_261;
+    for (let index = 0; index < value.length; index += 1) {
+        hash ^= value.codePointAt(index) ?? 0;
+        hash = Math.imul(hash, 16_777_619);
+    }
+    const unsignedHash = hash < 0 ? hash + 4_294_967_296 : hash;
+    return `fnv1a32:${unsignedHash.toString(16).padStart(8, "0")}`;
+};
+export const parseStorageSchemaGeneratorRequest = (request) => normalizeRequest(request);
+export const generateStorageArtifacts = (request) => {
+    const normalized = normalizeRequest(request);
+    const featureSelection = resolveStorageFeatures(normalized.features);
+    const resolved = normalized.outputs.some(({ kind }) => kind === "development-seed")
+        ? includeDevelopmentSeedRequirements(featureSelection)
+        : featureSelection;
+    const schemaVersion = storageSchemaVersions[normalized.database];
+    const files = [];
+    const warnings = [];
+    for (const output of normalized.outputs) {
+        if (output.kind === "migration-sql") {
+            files.push(...sqlFiles(normalized.database, output.layout, resolved));
+        }
+        else if (output.kind === "drizzle-schema") {
+            files.push(...drizzleFiles(normalized.database, output.layout, output.includeRelations, resolved));
+            if (output.includeRelations) {
+                warnings.push(`Drizzle relations are application-level only and do not create ${normalized.database === "postgres" ? "PostgreSQL" : "SQLite"} foreign keys.`);
+            }
+        }
+        else {
+            files.push(...developmentSeedFiles(normalized.adapter, output.target, normalized.features.includes("password"), output.complexity));
+            warnings.push("The generated development seed creates public demo credentials and must never run against production data.");
+            if (!normalized.features.includes("password")) {
+                warnings.push("The selected features do not include password authentication, so the development seed does not create password credentials.");
+            }
+        }
+    }
+    const fingerprintInput = JSON.stringify({
+        schemaVersion,
+        request: normalized,
+        resolved,
+        files,
+        warnings,
+    });
+    return {
+        apiVersion: storageSchemaGeneratorApiVersion,
+        generatorVersion: storageSchemaGeneratorVersion,
+        schemaVersion,
+        fingerprint: fingerprint(fingerprintInput),
+        request: normalized,
+        resolved,
+        files,
+        warnings,
+    };
+};
+//# sourceMappingURL=StorageSchemaGenerator.js.map